Learn Why ‘less’ is Faster Than ‘more’ Command for Effective File Navigation

More is a *nix command line used to display the contents of a file in a console. The basic usage of more command is to run the command against a file as shown below:

Read Also: Learn Difference Between ‘cat’ and ‘tac’ Commands with Examples

Learn Linux ‘more’ Command

# more /var/log/auth.log

Apr 12 11:50:01 tecmint CRON[6932]: pam_unix(cron:session): session opened for user root by (uid=0)
Apr 12 11:50:01 tecmint CRON[6932]: pam_unix(cron:session): session closed for user root
Apr 12 11:55:01 tecmint CRON[7159]: pam_unix(cron:session): session opened for user root by (uid=0)
Apr 12 11:55:01 tecmint CRON[7160]: pam_unix(cron:session): session opened for user root by (uid=0)
Apr 12 11:55:01 tecmint CRON[7160]: pam_unix(cron:session): session closed for user root
Apr 12 11:55:02 tecmint CRON[7159]: pam_unix(cron:session): session closed for user root
Apr 12 12:00:01 tecmint CRON[7290]: pam_unix(cron:session): session opened for user root by (uid=0)
Apr 12 12:00:01 tecmint CRON[7290]: pam_unix(cron:session): session closed for user root
Apr 12 12:05:01 tecmint CRON[7435]: pam_unix(cron:session): session opened for user root by (uid=0)
Apr 12 12:05:01 tecmint CRON[7436]: pam_unix(cron:session): session opened for user root by (uid=0)
Apr 12 12:05:01 tecmint CRON[7436]: pam_unix(cron:session): session closed for user root
Apr 12 12:05:02 tecmint CRON[7435]: pam_unix(cron:session): session closed for user root
Apr 12 12:09:01 tecmint CRON[7542]: pam_unix(cron:session): session opened for user root by (uid=0)
Apr 12 12:09:01 tecmint CRON[7542]: pam_unix(cron:session): session closed for user root
Apr 12 12:10:01 tecmint CRON[7577]: pam_unix(cron:session): session opened for user root by (uid=0)
Apr 12 12:10:01 tecmint CRON[7577]: pam_unix(cron:session): session closed for user root
Apr 12 12:15:01 tecmint CRON[7699]: pam_unix(cron:session): session opened for user root by (uid=0)
Apr 12 12:15:01 tecmint CRON[7700]: pam_unix(cron:session): session opened for user root by (uid=0)
Apr 12 12:15:01 tecmint CRON[7700]: pam_unix(cron:session): session closed for user root
Apr 12 12:15:01 tecmint CRON[7699]: pam_unix(cron:session): session closed for user root
....

Another way to use more command in conjunction (pipe) with other commands, such as cat command, as presented on below example:

# cat /var/log/auth.log | more

View and Navigate Contents of File

In order to navigate through the file line by line press Enter key or press Spacebar key to navigate one page at a time, the page being your current terminal screen size. To exit the command just press q key.

A useful option of more command is the -number switch which allows you to set the number of line a page should contain. As an example display the auth.log file as a page of 10 lines:

# more -10 /var/log/auth.log

Show Only First 10 Lines of File

Also, you can display a page starting from a specific line number using the +number option as illustrated below:

# more +14 /var/log/auth.log

Apr 12 12:09:01 tecmint CRON[7542]: pam_unix(cron:session): session closed for user root
Apr 12 12:10:01 tecmint CRON[7577]: pam_unix(cron:session): session opened for user root by (
uid=0)
Apr 12 12:10:01 tecmint CRON[7577]: pam_unix(cron:session): session closed for user root
Apr 12 12:15:01 tecmint CRON[7699]: pam_unix(cron:session): session opened for user root by (
uid=0)
Apr 12 12:15:01 tecmint CRON[7700]: pam_unix(cron:session): session opened for user root by (
uid=0)
Apr 12 12:15:01 tecmint CRON[7700]: pam_unix(cron:session): session closed for user root
Apr 12 12:15:01 tecmint CRON[7699]: pam_unix(cron:session): session closed for user root
Apr 12 12:16:01 tecmint mate-screensaver-dialog: gkr-pam: unlocked login keyring
Apr 12 12:17:01 tecmint CRON[7793]: pam_unix(cron:session): session opened for user root by (
uid=0)
Apr 12 12:17:01 tecmint CRON[7793]: pam_unix(cron:session): session closed for user root
Apr 12 12:20:01 tecmint CRON[7905]: pam_unix(cron:session): session opened for user root by (
uid=0)
Apr 12 12:20:01 tecmint CRON[7905]: pam_unix(cron:session): session closed for user root
Apr 12 12:25:01 tecmint CRON[8107]: pam_unix(cron:session): session opened for user root by (
uid=0)
Apr 12 12:25:01 tecmint CRON[8108]: pam_unix(cron:session): session opened for user root by (

Learn Linux ‘less’ Command

Similar to more, less command allows you to view the contents of a file and navigate through file. The main difference between more and less is that less command is faster because it does not load the entire file at once and allows navigation though file using page up/down keys.

In can be used as a standalone command issued against a file or used with pipes with a multitude of Linux commands in order to narrow their screen output allowing you to scroll through results.

# less /var/log/auth.log
# ls /etc | less

You can navigate through the file line by line pressing Enter key. Page navigation can be handled with spacebar key. The page size is represented by your current terminal screen size. To exit command type q key, same way as for more command.

A useful feature of less command is the use of /word-to-seach option. For instance you can search and match all sshd messages from a log file by interactively specifying the /sshd string.

View File Content Using less Command

In order to display a file staring at a specific line number use the following syntax:

# less +5 /var/log/auth.log

If you need to track down the number of every line with less command use the -N option.

# less -N /var/log/daemon.log

      1 Apr 12 11:50:01 tecmint CRON[6932]: pam_unix(cron:session): session opened for user root by (uid=0)
      2 Apr 12 11:50:01 tecmint CRON[6932]: pam_unix(cron:session): session closed for user root
      3 Apr 12 11:55:01 tecmint CRON[7159]: pam_unix(cron:session): session opened for user root by (uid=0)
      4 Apr 12 11:55:01 tecmint CRON[7160]: pam_unix(cron:session): session opened for user root by (uid=0)
      5 Apr 12 11:55:01 tecmint CRON[7160]: pam_unix(cron:session): session closed for user root
      6 Apr 12 11:55:02 tecmint CRON[7159]: pam_unix(cron:session): session closed for user root
      7 Apr 12 12:00:01 tecmint CRON[7290]: pam_unix(cron:session): session opened for user root by (uid=0)
      8 Apr 12 12:00:01 tecmint CRON[7290]: pam_unix(cron:session): session closed for user root
      9 Apr 12 12:05:01 tecmint CRON[7435]: pam_unix(cron:session): session opened for user root by (uid=0)
     10 Apr 12 12:05:01 tecmint CRON[7436]: pam_unix(cron:session): session opened for user root by (uid=0)
     11 Apr 12 12:05:01 tecmint CRON[7436]: pam_unix(cron:session): session closed for user root

By default the only way to exit less command is to hit q key. To change this behavior and automatically exit file when reaching the end of file use the -e or -E option:

# less -e /var/log/auth.log
# less -E /var/log/auth.log

To open a file at the first occurrence of a pattern use the following syntax:

# less +/sshd /var/log/auth.log

Apr 12 16:19:39 tecmint sshd[16666]: Accepted password for tecmint from 192.168.0.15 port 41634 ssh2
Apr 12 16:19:39 tecmint sshd[16666]: pam_unix(sshd:session): session opened for user tecmint by (uid=0)
Apr 12 16:19:39 tecmint systemd-logind[954]: New session 1 of user tecmint.
Apr 12 16:19:48 tecmint sshd[16728]: Received disconnect from 192.168.0.15: 11: disconnected by user
Apr 12 16:19:48 tecmint sshd[16666]: pam_unix(sshd:session): session closed for user tecmint
Apr 12 16:20:01 tecmint CRON[16799]: pam_unix(cron:session): session opened for user root by (uid=0)
Apr 12 16:20:02 tecmint CRON[16799]: pam_unix(cron:session): session closed for user root
Apr 12 16:25:01 tecmint CRON[17026]: pam_unix(cron:session): session opened for user root by (uid=0)
Apr 12 16:25:01 tecmint CRON[17025]: pam_unix(cron:session): session opened for user root by (uid=0)

The above command tells less to open auth.log file at the first match of sshd string.

In order to automatically append the content of a file opened in less command use the Shift+f keys combination or run less with the following syntax.

# less +F /var/log/syslog

This makes less to run in interactive mode (live) and display new content on-fly while waiting for new data to be written to file. This behavior is similar to tail -f command.

In combination with a pattern you can watch the log file interactively with Shift+f key stroke while matching a keyword. To exit live mode just press Ctrl+c keys.

# less +/CRON /var/log/syslog

Whether you decide to use more or less, which is a personal choice, remember that less is more with more features.

Read Also: Manage Files Effectively Using head, tail and cat Commands